Privacy Policy

Last updated: June 2026

MusicStudio ("we", "us", "our") is committed to protecting the personal data of students and teachers who use our platform. This policy explains what data we collect, why we collect it, and your rights under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

Data we collect

Account data: name, email address, password (hashed), and profile information you provide when registering.
Lesson data: booking times, lesson notes, and communications with your teacher or student.
Payment data: we use Stripe to process payments. We store only the last 4 digits of your card and your transaction history. Full card details are never stored on our servers.
Video recordings: with your consent, lessons may be recorded. Recordings are stored securely and deleted after 30 days.
In-lesson whiteboard and chat: the shared whiteboard and the text chat inside a lesson are not part of the video recording, so we keep a separate record of them — the strokes drawn on the whiteboard and the messages sent in the chat, together with who sent them and when. We keep this solely to protect students and teachers: to investigate a safeguarding concern or resolve a dispute about what happened in a lesson. It is not visible to you or to the other person in the lesson, and it is not used for advertising or profiling. It can only be accessed by authorised MusicStudio staff when there is a specific concern to look into, and it is deleted automatically after 12 months. You can request a copy of it at any time.
Emails we send you: we keep a copy of every email we send you — the full content, the subject, when it was sent, and whether it was delivered, opened or bounced. We keep this so that we, and you, have a reliable record of what you were told: what a booking confirmation actually said, what a cancellation notice actually said, and when. It is used to answer your questions and to resolve disputes, never for advertising or profiling. It can only be accessed by authorised MusicStudio staff, and it is deleted automatically after 24 months. You can request a copy at any time, and it is deleted when you delete your account.
Messages between you and your teacher: messages you send through the platform, including any photos or files you attach, are stored so that both of you can refer back to them and so we can investigate a safeguarding concern or a dispute.
Automated checks for contact details: messages, in-call chat, whiteboard text and teacher profiles are checked automatically for email addresses, phone numbers and links to other messaging services. This is how we keep conversation on the platform, where there is a record of it — lessons often involve children, and our terms do not permit a teacher to contact a student privately elsewhere. Where a message contains an email address or a link to another messaging service, it is not sent and you are told why, so that you can edit it. Other matches, such as something resembling a phone number, are delivered normally but recorded. In both cases the text is kept for up to 24 months so that a member of our staff can review it, and it is never shown to the other person or used for advertising. No decision with a legal or similarly significant effect is made automatically — a person reviews anything that matters.
Usage data: we use Google Analytics 4 (GA4) and PostHog to understand how the platform is used, and (with your marketing consent) the Meta (Facebook) Pixel to measure the effectiveness of our advertising. In regions that require prior consent (such as the EU/EEA and the UK), none of these load until you accept the relevant cookies; in other regions (such as the US), analytics may be enabled by default and you can opt out at any time. The marketing pixel always requires your acceptance.
Technical and attribution data: we record your IP address and basic device/browser information, and — where applicable — marketing attribution data (such as referrer, UTM campaign parameters and ad-click identifiers like fbclid and gclid) so we can keep the platform secure and understand how visitors find us.

Cookies

We use cookies and similar technologies, grouped into three categories, and ask for your consent through our cookie banner:

Necessary — required for the platform to function (for example, keeping you logged in and securing forms). These are always on and cannot be switched off.
Analytics — set only after you accept analytics cookies. These power GA4 and PostHog so we can measure and improve the platform.
Marketing — set only after you accept marketing cookies. These power the Meta (Facebook) Pixel and help us measure and target our advertising.

How consent is obtained depends on your location. Where the law requires prior consent (the EU/EEA and the UK), analytics and marketing cookies stay off until you accept them. In other regions (such as the US), analytics cookies may be enabled by default, while marketing cookies still require your acceptance. Either way, you can change or withdraw your cookie choices at any time using the cookie settings on the site.

Your rights

Under GDPR you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Erase your data (right to be forgotten)
Object to how we process your data
Data portability — receive a copy of your data in a machine-readable format
Withdraw consent at any time for processing based on consent

Data retention

We keep your account data for as long as your account is active. Lesson recordings are deleted after 30 days. The in-lesson whiteboard and chat record described above is deleted after 12 months. Copies of emails we sent you are deleted after 24 months. Financial records are retained for 7 years as required by Irish law.

If you are a teacher and you ask us to delete your data: we will delete your account and everything described above. However, where you have earned money through MusicStudio, Irish and EU tax law requires us to keep a limited record even after you leave. This is not a choice we make — it is an obligation under the platform-reporting rules (DAC7), the rules on reporting payments to service providers (Form 46G), and the general requirement to keep books, records and VAT documentation.

That record contains only what those obligations need: your legal name and, for an individual, date of birth; your address; your tax identification number and country of tax residence; your VAT number and status; the bank account we paid you into; and yearly totals of the lessons you taught, the fees you were paid and the commission we charged. It is held encrypted, is accessible only to authorised staff for tax and audit purposes, is never used for any other reason, and is automatically deleted 7 years after your account is erased. Nothing else about you is kept.

If you never earned money through MusicStudio, no such obligation arises and your data is deleted in full.

Your IP address and device/browser information are kept only for a short period (typically up to 90 days) for security and troubleshooting, after which they are cleared. Marketing attribution data (referrer, UTM parameters and ad-click identifiers) is retained for a maximum of 2 years and then reviewed and deleted.

Contact us

To exercise any of your rights or to ask questions about this policy, please contact us.

Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC), the supervisory authority for data protection in Ireland — www.dataprotection.ie.

Data controller

The data controller responsible for your personal data is:
Luteic Limited, trading as MusicStudio — a company registered in Ireland.
Registered office: 77 Camden Street Lower, Dublin 2, D02 XE80, Ireland
Company registration number: 779344
VAT registration number: IE4382912SH
Data protection contact: via our contact form.